This guide shows how to configure an IPsec IKEv2 site-to-site VPN between a Peplink B One Plus and a FortiGate firewall.
The goal is to provide secure communication between the Peplink LAN 192.168.50.0/24 and the FortiGate LAN 192.168.1.0/24.
Network Topology
Configure IPsec on Peplink
Open the Peplink IPsec VPN configuration and create a new profile.
Configure the basic VPN settings:
Use the same strong pre-shared key on both Peplink and FortiGate.
Configure Peplink Phase 1
Configure the IKEv2 Phase 1 proposal:
Configure Peplink Phase 2
Configure the IPsec ESP proposal:
Under WAN Connection Priority, select WAN 2 as the preferred connection.
Configure IPsec on FortiGate
Create a new IPsec tunnel on the FortiGate and configure the network parameters:
Configure FortiGate Authentication and Phase 1
Configure the same pre-shared key and matching IKEv2 parameters:
Configure FortiGate Phase 2
Create the Phase 2 selector for the two protected networks:
The Phase 2 cryptographic parameters must match the Peplink configuration:
Configure FortiGate Firewall Policies
Allow traffic between the FortiGate LAN and the IPsec tunnel. Firewall policies should permit communication in both required directions:
Source NAT should normally be disabled for traffic between the two VPN networks.
Verify the VPN on Peplink
After both sides are configured, the Peplink IPsec VPN status should become active and show the protected networks:
Verify the VPN on FortiGate
Check the IPsec tunnel status from the FortiGate CLI:
For detailed IPsec Security Association information:
Check the IKE gateway status:
Test Traffic Through the VPN
Test communication between hosts in the two networks:
If the tunnel is established but traffic does not pass, verify the Phase 2 selectors, firewall policies and that NAT is not applied to VPN traffic.
Screenshot with configurations
Below is screenshot with configurations on both sides.
